hm it would be VERY difficult to find the diffrence between real video file or Virus modified video file...There should be some kind of checksum which indicates that if there is any "abnormal data" normaly header + video data it self can be identifeid quit easy.
e.g .avi is a windows video contaiener... hm if you have resolution from video codec.. may be you can calculate... ..ah itīs too hot i need a break
wbr Shin Gouki